Toward Finding S-Box Circuits With Optimal Multiplicative Complexity

In this paper, we present a new method to find S-box circuits with optimal multiplicative complexity (MC), i.e., MC-optimal S-box circuits. We provide new observations for efficiently constructing circuits and computing MC, combined with a popular pathfinding algorithm named A*. In our search, the A* algorithm outputs a path of length MC, corresponding to an MC-optimal circuit. Based on an in-depth analysis of the process of computing MC, we enable the A* algorithm to function within our graph to investigate a wider range of S-boxes than existing methods such as the SAT-solver-based tool
[1]
and
LIGHTER

[2]
. We provide implementable MC-optimal circuits for all the quadratic 5-bit bijective S-boxes and existing 5-bit almost-perfect nonlinear (APN) S-boxes. Furthermore, we present MC-optimal circuits for 6-bit S-boxes such as Sarkar Gold, Sarkar Quadratic, and some quadratic permutations. Finally, we theoretically demonstrate new lower bounds for the MCs of S-boxes, providing tighter bounds for the MCs of
AES
and
MISTY
S-boxes than previously known. This study complements previous results on MC-optimal S-box circuits and is intended to provide further insight into this field.